how/network

The OSI model and encapsulation

7 layers: what TCP adds, what IP adds, what Ethernet adds. Why "layers" are not theory but concrete bytes in a packet.

The OSI model splits the network stack into 7 layers, each of which handles its own job and stays out of the others'. When your browser makes an HTTP request, that request goes down the stack, picking up its own header at each layer (encapsulation), travels across the wire to the server, and there comes back up, shedding a header at each layer (decapsulation).

Layers are not a textbook abstraction. They are real bytes that you can see in tcpdump. Understanding this splits DevOps people into those who fix the network and those who guess.

Press ▶ to watch an HTTP request go through all 7 layers and back.

step 1/12·00 · two stacks of 7 layers each

§ steps

On the left is the sender's stack, on the right the receiver's. At the bottom both sides are joined by the wire (L1 = the physical layer).

The idea: each layer talks to its mirror on the other side. The sender's TCP "talks" to the receiver's TCP, IP to IP, and so on. Because of this you can change the implementation of any layer independently of the rest. TCP does not care how exactly the bits run down the wire.

recap

What to remember:

Each layer talks to its mirror on the other side: the L7 application "talks" to the L7 server, L4 (TCP) to L4 (TCP), L3 (IP) to L3 (IP), and so on. Nobody reaches across layers
Encapsulation = adding headers from top to bottom. MTU puts a ceiling on the frame size (typically 1500 on Ethernet). If payload + headers is larger, IP fragments (or asks the sender to shrink it via PMTUD)
The TCP/IP model merges L5/L6/L7 into a single "application layer". In real life nobody cares about that split. What matters is to remember L4/L3/L2/L1, which you see in dumps
It helps to map problems onto layers in your head:
- the link does not come up → L1/L2 (cable, MAC, VLAN)
- ping does not go through → L3 (IP, route, firewall)
- the socket opens but does not answer → L4 (TCP, port, proxying)
- HTTP returns 5xx → L7 (the application)
TLS lives between L4 and L7. Formally it is placed at L6 (presentation), although in modern stacks it is just a "secured L7 layer over TCP"

This is the base on which every other explainer is built: DHCP, ARP, DNS, NAT, routing, each works at its own layer.

§ dig into the knowledge base

§ steps

On the left is the sender's stack, on the right the receiver's. At the bottom both sides are joined by the wire (L1 = the physical layer).

The idea: each layer talks to its mirror on the other side. The sender's TCP "talks" to the receiver's TCP, IP to IP, and so on. Because of this you can change the implementation of any layer independently of the rest. TCP does not care how exactly the bits run down the wire.